CVE-2026-94056 is a high severity (CVSS 7.5) flaw in Exim before 4.100.1. When Proxy Protocol is used with an attacker-controlled proxy, an attacker can read certain uninitialized data from stack memory. Upgrade to Exim 4.100.1 or later and confirm with the Exim announcement.
What's affected
The record says Exim before 4.100.1 is affected when Proxy Protocol is in use with an attacker-controlled proxy. The weakness is CWE-908, use of uninitialized resource. I could not load the Exim announcement the record points to, so I cannot add detail beyond the record. Read that message on the Exim list before you plan the change.
The condition matters. Proxy Protocol lets a trusted load balancer pass the real client address to the mail server. If Proxy Protocol is not enabled, or the only hosts allowed to speak it are ones you control, the exposure is much smaller. The vector marks high attack complexity and a changed scope, which fits a flaw that needs a particular setup.
How to check if you're exposed
Check your Exim version and whether Proxy Protocol is configured.
exim -bV | head -3
exim -bP hosts_proxy
The hosts_proxy option lists the hosts allowed to send Proxy Protocol headers. If it is empty or unset, the feature is not in use for inbound connections. If it lists addresses, work out who controls each one. A proxy that you run is lower risk than a range that others can reach.
On Linux distributions, check the package changelog too, since fixes are often backported without a version bump.
What to do now
- Upgrade Exim to 4.100.1 or later, or install your distribution's patched package.
- Review the hosts_proxy setting and keep it to the exact addresses of proxies you operate.
- Make sure only your own load balancers can reach the SMTP port that accepts Proxy Protocol, using firewall rules.
- After the upgrade, restart the Exim daemon so running processes load the new binary.
- Read the Exim announcement for any extra steps the maintainers list.
Why it matters
Reading uninitialized memory can disclose whatever was left on the stack by earlier use. Depending on what that is, an attacker may learn information about the process that helps with other attacks. CWE-908 is an old class of bug, and it is rated here for confidentiality impact rather than for running code.
The record does not mark exploitation, and the CVE is not in CISA's catalog. Mail servers sit on the internet by design and are routine targets, so patching on a normal schedule is sensible even though the condition is narrow.
Quick check
Does this affect Exim without Proxy Protocol?
The record ties the flaw to Proxy Protocol with an attacker-controlled proxy. Check your configuration, and upgrade anyway.
Which version fixes it?
Exim 4.100.1, per the record.
Sources
Last reviewed: 18 October 2026.
